Temporal and Multimodal Deep Learning for Cyberattack Detection in LEO Satellite Systems

2026-09-09

AI Summary

本文针对LEO卫星系统中的网络攻击检测问题，提出了一种结合硬件、轨道及RF信息的多模态深度学习方法，并通过UNSW-IoTSAT数据集验证了其有效性。

Abstract

The growing reliance on Low-Earth Orbit (LEO) satellite communication systems has increased the need for intelligent methods capable of detecting cyberattacks across complex and dynamic space environments. Unlike conventional network intrusion detection, satellite systems generate heterogeneous information across radio-frequency (RF) links, onboard hardware, and orbital operations. However, many existing approaches either rely on terrestrial intrusion datasets or evaluate individual observations independently, limiting their ability to capture temporal attack behavior specific to LEO satellites. In this work, we conduct a systematic study of deep-learning-based cyberattack detection using the recently introduced satellite-specific UNSW-IoTSAT dataset. We investigate structured learning architectures that preserve hardware, orbital, and RF information, including a Subsystem-Fusion MLP and a hierarchical multimodal Transformer that models both cross-subsystem interactions and temporal evolution. We further evaluate leakage-resistant row-level and temporal settings, along with cross-satellite generalization, to characterize how model architecture and evaluation protocol influence satellite cyberattack detection. Experimental results demonstrate the value of structured multimodal modeling and rigorous evaluation, with the hierarchical Transformer achieving up to 91.66% accuracy and 85.63% macro F1 under the leakage-resistant evaluation protocol.

Problem

• Low-Earth Orbit
• cyberattacks
• heterogeneous information
• temporal attack behavior
• satellite systems

Innovation

• Hierarchical Multimodal Transformer
• Subsystem-Fusion MLP
• Temporal Attack Behavior
• Cross-Subsystem Interactions
• Satellite Cyberattack Detection